diff --git a/[refs] b/[refs]
index c08567684858..d5333ebc61e3 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 102f097f1937db41f59674caca0a1e38c963baba
+refs/heads/master: b07f08a56524cdc49001b1467743acc3c5b78962
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-testmode.c b/trunk/drivers/net/wireless/iwlwifi/iwl-testmode.c
index 2fc20675dc7b..58575fdc4504 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-testmode.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-testmode.c
@@ -733,7 +733,7 @@ static int iwl_testmode_ownership(struct ieee80211_hw *hw, struct nlattr **tb)
 static int iwl_testmode_sram(struct ieee80211_hw *hw, struct nlattr **tb)
 {
 	struct iwl_priv *priv = hw->priv;
-	u32 base, ofs, size, maxsize;
+	u32 ofs, size, maxsize;
 
 	if (priv->testmode_sram.sram_readed)
 		return -EBUSY;
@@ -765,7 +765,7 @@ static int iwl_testmode_sram(struct ieee80211_hw *hw, struct nlattr **tb)
 		IWL_DEBUG_INFO(priv, "Error, unsupported uCode type\n");
 		return -ENOSYS;
 	}
-	if ((ofs + size) > maxsize) {
+	if ((ofs + size) > (maxsize + SRAM_DATA_SEG_OFFSET)) {
 		IWL_DEBUG_INFO(priv, "Invalid offset/size: out of range\n");
 		return -EINVAL;
 	}
@@ -776,8 +776,7 @@ static int iwl_testmode_sram(struct ieee80211_hw *hw, struct nlattr **tb)
 		IWL_DEBUG_INFO(priv, "Error allocating memory\n");
 		return -ENOMEM;
 	}
-	base = 0x800000;
-	_iwl_read_targ_mem_words(bus(priv), base + ofs,
+	_iwl_read_targ_mem_words(bus(priv), ofs,
 					priv->testmode_sram.buff_addr,
 					priv->testmode_sram.buff_size / 4);
 	priv->testmode_sram.num_chunks =
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-testmode.h b/trunk/drivers/net/wireless/iwlwifi/iwl-testmode.h
index 26138f110340..9c6a67ab5c34 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-testmode.h
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-testmode.h
@@ -271,4 +271,7 @@ enum iwl_tm_attr_t {
 /* Maximum data size of each dump it packet */
 #define DUMP_CHUNK_SIZE		(PAGE_SIZE - 1024)
 
+/* Address offset of data segment in SRAM */
+#define SRAM_DATA_SEG_OFFSET   0x800000
+
 #endif